Re: [PATCH net-next v6 4/5] net: wangxun: implement soft quiesce for PCIe error recovery

[Simon Horman <horms@kernel.org>]

On Wed, Jun 10, 2026 at 02:09:16PM +0800, Jiawen Wu wrote:
> Function wx_soft_quiesce() provide a lightweight shutdown path during
> PCIe error recovery. It avoids MMIO-dependent operations in PCIe error
> status.
> 
> Waiting for the service task to complete may unnecessarily delay PCIe
> error recovery, especially if the work item is already blocked by the
> hardware failure that triggered AER. So the service task is not
> explicitly cancelled in quiesce path. As a measure to block the service
> task, the checking of WX_STATE_DOWN and WX_STATE_RESETTING is added at
> the entry of every work item.
> 
> Signed-off-by: Jiawen Wu <jiawenwu@trustnetic.com>
> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>

...

> diff --git a/drivers/net/ethernet/wangxun/libwx/wx_ptp.c b/drivers/net/ethernet/wangxun/libwx/wx_ptp.c
> index 44f3e6505246..dcc8b3ae1445 100644
> --- a/drivers/net/ethernet/wangxun/libwx/wx_ptp.c
> +++ b/drivers/net/ethernet/wangxun/libwx/wx_ptp.c
> @@ -842,6 +842,27 @@ void wx_ptp_stop(struct wx *wx)
>  }
>  EXPORT_SYMBOL(wx_ptp_stop);
>  
> +void wx_ptp_quiesce(struct wx *wx)
> +{
> +	if (!test_and_clear_bit(WX_STATE_PTP_RUNNING, wx->state))
> +		return;
> +
> +	clear_bit(WX_FLAG_PTP_PPS_ENABLED, wx->flags);
> +
> +	if (wx->ptp_tx_skb) {
> +		dev_kfree_skb_any(wx->ptp_tx_skb);
> +		wx->ptp_tx_skb = NULL;
> +	}

AI-generated review of this patch on sashiko.dev flags a potential UAF here:

	"Could freeing wx->ptp_tx_skb here cause a use-after-free or
	double-free?

	"Because ptp_clock_unregister() is called after this block, the PTP
	 kworker might still be running.

	"If wx_ptp_tx_hwtstamp() reads wx->ptp_tx_skb just before this
	 free, it will pass the freed skb to skb_tstamp_tx() and call
	 dev_kfree_skb_any() on it again.

I'd appreciate it if you could look into that.

I believe that the other issues raised in that AI-generated review have
already been discussed in the context of earlier versions of this
patch-set.

> +	clear_bit_unlock(WX_STATE_PTP_TX_IN_PROGRESS, wx->state);
> +
> +	if (wx->ptp_clock) {
> +		ptp_clock_unregister(wx->ptp_clock);
> +		wx->ptp_clock = NULL;
> +		dev_info(&wx->pdev->dev, "removed PHC on %s\n", wx->netdev->name);
> +	}
> +}

...